The botnet’s infections remained low over the past years, instead focusing on pharmaceutical attacks, researchers said.

Following each campaign, the botnet would remain dormant for a certain time frame, but that all changed in mid-June, when Kelihos started spamming other malware.

Kelihos started sending out the Wildfire ransomware.

“The ransomware itself appears to be the work of scriptkiddies (the code is very amateur, it utilizes the .Net framework, and the C&C servers are hosted using a shared hosting sold on an English language scriptkiddie forum); these are not the sort of people you’d expect to be involved with a Russia spam veteran,” said researchers at MalwareTech in a post. “Once the wildfire had died down, Kelihos went on to spread ransomware from another author as well as a banking Trojan based on the Zeus source code. It’s quite possible the Kelihos operator has come to the realization that spamming ransomware and banking Trojans is a far more profitable than the dying art of pump and dump spam.”

The increase in Kelihos infections started when the botnet was still dropping the Wildfire ransomware, but remained very small between June 27 and July 5, MalwareTech said. Starting July 11, a program kicked off, resulting in the botnet’s size growing from around 8,000 infections to around 13,000.

The size remained steady for more than a month, followed by a massive spike August 22, when 16,000 new infections were registered in only 3 hours (9,000 of them in the first 10 minutes). Kelihos continued to grow over the 24 hours following the initial spike, and the botnet reached 34,533 infections.

The campaign doesn’t appear to have been targeted to a specific geography.

“When mapped out the data reads like any other indiscriminate malware campaign with infections tied mainly to global population centers and the majority in developing countries,” MalwareTech said.